Ministry of the Interior, Kingdom of Saudi Arabia, 
High Commission for Industrial Security HCIS 



Understanding the New Directives and their impact on the 
projects and existing security of industrial facilities in KSA 



















The High Commission for Industrial Security is part of the 
Ministry of Interior. It is responsible for the development and 
implementation of security, safety and fire protection 
strategies kingdom-wide. 



























I The national security of Saudi Arabia, including the security of 
f the economy and the well being of its population, depends 
directly on physical and operational safety of all types of 
industrial facilities across Saudi Arabia. Therefore, the HCIS 
shall have the ultimate authority on administering these 
requirements. 

The HCIS is the “Authority having Jurisdiction” 





























HCIS History 
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■ In the past the HCIS was known as the HCISS and worked to 
I an old set of standards. The name was changed to the HCVS 
f and a new set of standards were issued by Royal Decree in 
2010. These new standards are the SEC and SAF directives 
and must be applied to every industrial project in Saudi 
Arabia. The Security directive is number 3870 dated 12/6/1431 
Hajiri, and the Safety directive number is 3871 dated 12/6/1431 
Hajiri. The dates equate to 20 th May 2010 Gregorian. 
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HCIS Approval 
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HCIS approval for security and safety systems is NOT a 
blanket approval. It is an individual approval for each and 
every project no matter the owner or type of project 






_—■—"Y 


t 





—x 




pi I * 





‘hl. . x 



































I I 






1 ■ 




t I 




i i 


r i 


l i ( 






1 ! 


! r 


I •- 


r r 


r t 


'll. 


< I I 




■ " ^ “ Si. », ■ ■ >* 1 " | 

m\w r 1 ’ ■ MViW. * * ■ * AVAw 1 
^vo v* »SWtS<? 1 ' ,r '* AWr\V ! • : 1 «V»; 

: r 1 r \ v f i E , , V/J vy V AS »VAU V V u 

■ t 1 1 1 t . ► . tW/A 1 ' l ! t r ► . , t *vV.\ 

WVmS , V. . i 11 • ■ ■ ■ - . .WAV.* 


! (- » 



1 T f f « 

f f 4 r p I > 



' r ■ . - i r 

■ « # • ► > | 

" ' 1 ' . 

Vh'V'T r ‘ tJ' ''"Utm 


i •••*• -■ - 


► jv 

~U Mi 

rV^[ j V TrTtf' V Y T" Y Y Y Y * r 1 1 

I »> ■ |i . ■ ■ i i |- •] P P | * P ” 

■" *% 'm ¥ ¥ 1 


I Ell. I l F, 

■ ^ '■ I ( ! > r | 1 


■rc f rp*r: :-i 

I E ! ! ft E I It t t. * 
V» * V f trill ! t. ! 




"VY 






V i 


'“V" “ -'- ■* ■ -f - - * if 

_ >‘TJI- ^ 3 - -J.fc* 1 

- / 

V'**--•« 

F ” ’I U '> 2 * -m 

•• \ >-■>. , 



___ f- l — ■* - - • _ ~ 

. 


! — _ *r ■ - * 




* - 





■Si 1 nr ■ A _fi 

;ri : ^ - r p: _£. -- t - • 


■>:•-.-V- 


N| ^ 


■f L 


JW-* 1 


A. 


^ Li: * 








* + 




I it 1 




-i5 ■> 


— * _ ■! — 


J aa. « 


& * a 

















Security Directives 



+Any facility considered a facility 
that supports a class 1, 2 or 3 
facility and is either adjacent or 
remote to class l f 2 f or 3 facilities 


*Any facility whose disruption, 
or serious damage could 
cause minimal or no damage 
to the kingdom’s economy or 
would not disrupt the we//- 
being of its population 








Any facility whose destruction 
or serious damage could 
seriously damage the 
kingdom’s economy or gravely 
disrupt the well being of its 
population 






•Any facility whose destruction or 
serious damage could cause short 
term damage to the kingdom's 
economy or temporarily disrupt 
the well being of their population 

























































General Requirements (SEC-01) 


4.1.1: The HCIS reserves the right to modify and/or make changes to the 
Security Directives without prior notice. 


4.1.2: The criticality of each facility varies depending on the product or service 
provided. 

4.1.3Ljhe^HCIS will have the ultimate authority on classifying all facilities. 
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4.1.4: The level of protection 







by its security classific 
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4.1.6: All security design shall be carried out by qualified security consultants 
approved by HCI&. ' „ A - ' j ; ■ J j - ■ - * 
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4.1.7: The operator shall develop a detailed security vulnerability assessment, 
or risk analysis, performed by a qualified security consultant, that shall be used 
as the basis of facility qualification. This SVA shall follow the API Methodology. 


4.1.8 The facility classification and Risk Analysis shall be submitted to HCIS for 
approval prior to security system design or implementation. 


The Security Directives 


SEC 01 - Application of Security Directives 


SEC 02 - Security Fencing 


SEC 03- Security Gate 


SEC 04 - Security Lighting 


SEC 05 - Integrated Security Systems 


SEC 06 - Security Devices 


SEC 07 - Power Supply 


SEC 08 - Communications 


SEC 09 - Security Doors 


SEC 10 - Security Locks 


SEC 11 - Identification Cards 


SEC 12 - Identification Protection 
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•Security 

Vulnerability 

Assessment 

(SVA) 


HCIS 

Approval 




HCIS 

Approval 


• Concept of 
Design (10%) 
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•Front End 
Engineering 
Design (30%) 
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* Detail Design 
(60%) 
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»Detail Design 
(90%) 
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• Issued for 
Construction 
( 100 %) 


HCIS 
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Approval 
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oSecurity Integrator Prequalification Review (HCIS bidder approval process 
required) 

oTechnical Scope of Work for client (Request for Proposal) 
oBid Evaluation (technicalevaluation of integrator bids) 


oPolicy, Plan and Procedures 
oManpower Study 

oSecurity Awareness and Training Programmes 
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Security Directives: 

Procedure 
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Security 

Vulnerability 

Assessment 

(SVA) 







The plant owner commissions a Security Vulnerability Assessment to be 
carried out by an HCIS approved Security Consultant. 

The SVA has to be carried out following the API methodology. The purpose 
of the SVA is twofold: 

1. Identify critical assets, threats, risks, vulnerability and propose 
mitigation measures 

2. Classify the facility according to a class 1 to 4 system. 










Security Directives: 

Procedure 


Concept of 
design (COD) 



After the approval of the Security Vulnerability Assessment, the plant 
owner commissions an HCIS approved Security consultant to take the 
results from the SVA and produce a security Concept of Design (COD) 


This Concept of Design (also called 10% Preliminary design) provides a 
design solution to the mitigation measures proposed and approved during 
the SVA exercise. 








r 


Security Directives: 

Procedure 


Front End 
Engineering 
Design 
(FEED) 


After the approval of the concept of design (COD), the plant owner 
commissions an HCIS approved Security consultant to produce a Front 
End Engineering Document from the SVA and Concept of Design (COD) 


The FEED (or 30% Design) will form the basis of the Technical Scope of 
Work that will form part of the Request for Proposal (RFP). 


This RFP will be issued to approved System Integrators to prepare a 
Tender Bid. 


The TSOW and RFP need not be approved by HCIS, but the FEED 
document does and the security system integrators must be approved by 
the HCIS. 


The EPC should submit the prequalification document of the security 
system integrator to the HCIS consultant for comment/approval before 
submission to the owner for transmission to and approval by the HCIS. 
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Security Directives: 

Procedure 


v_ j 


Detailed 
Design 60% 


After the award of the security contract to an approved integrator the 
integrator will produce a 60% detailed design that is in accordance with the 
FEED design (30%). The design will include details of all hardware and 
software to be used and will detail how the software is configured to 
produce an integrated system. 


The 60% detailed design is submitted to the HCIS approved consultant for 
comment and review before submittal by the EPC to the owner for 
transmission and approval by the HCIS. 









Security Directives: 

Procedure 


Detailed 
Design 90% 


After the approval of the 60% detailed design the Security Systems 
integrator will produce the 90% engineering submittal. This will include 
information on the total system down to individual field item level showing 
location, mechanical installation and all electrical terminations 


The 90% detailed design is submitted to the HCIS approved consultant for 
comment and review before submittal by the EPC to the owner for 
transmission and approval by the HCIS. 
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Security Directives: 

Issued For 


Procedure 

Construction 
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After the approval of the 90% design package the Security Systems 
Integrator will prepare the system for the Factory Acceptance Test (FAT) 

The Security System Integrator will produce a FAT document for submittal 
and approval by the HCIS before the FAT is carried out. 

The FAT will be attended by the HCIS representative, the HCIS consultant, 
the owner and the EPC. 

The approved consultant will lead a Site Acceptance Test (SAT) and issue a 
Final Completion report (100%) for the HCIS. 

































































































4.5 Requirements for Executing Fire Protection Projects (SAF) 


4.5.1 Designers, suppliers, contractors shall be approved by the HCIS. 


4.5.3 Contractors and suppliers shall be certified by the Ministry of Interior (Civil Defense) and Ministry 
Commerce and Industry. 


4.5.4 The Owner shall submit qualification documents to the HCIS for approval 




4.5.5 The Owner shalFensur^that the tympany Selected for safety and fire protection related work shal 
adequate engineering capabilities and qualified manpower to design/install, test ^nd.maintain the safe! 
fire protection systems and executejaJU)ther work requirements competently.. . . 
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4,5.7 The HCIS reserves the exclusive right to approve or reject any candidate design agency performin 
work. 
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4.5.8 The Owner shaft ensure that the company 





safety and fire protection related work shal 


prior technical experience. 

4.5.11 The HCIS shall have the right to reject any equipment, system, or suppliers 


4.5.14 The Owner shall not permit any start on safety and fire protection related work until HCIS approv 
the design, contractor, major fire protection equipment and systems is received. 



The Safety Directives (1) 


SAF 01 -Application of Safety and Fire Protection Directives 


SAF 02 - Environmental, Health and Safety (EHS) Management 


SAF 03 - Plant Buildings 




SAF 04 - Fire Protection Systems 




SAF 05 - Industrial Drainage 


SAF 06 -Plant Layout, Spacing, and Access 


SAF 07 - Well site Safety 
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SAF 08 - Storage Tanks and Storage Vessels 


SAF 09 - Fireproofing in Plants 


SAF 10 - Pressure Piping, Pressure Vessels, and Transportation Pipelines 


SAF 11 - Emergency Shutdown, Isolation, and De-pressuring 


SAF 12 - Electrical Safety 





















































































The Safety Directives (2) 




































































Safety Directives: 



Preliminary 
Design Phase 



Normally carried ou 
at the FEED stage to 
produce a document 
that meets HCIS 
requirements and an 
EPC can bid against 




HCIS 

Approval 


Detailed 
Design Phase 


Operational 
Aspects (j prior 
to operations ) 


II HCIS 
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HCIS 

Approval 
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Approval 



roduced by a local Saudi 
Fire contractor as part of 
a design, supply, install 
and commission contract 


Produced by either the 
owner or the EPC and 
must include all 
operational aspects of 
safety. 
































Safety Directives: 


Preliminary 
Design Phase 



General plot plans 
showing fire main & 
pump house, site 
drainage, building 
spacing etc. and 
general specifications 





HCIS 

Approval 


Detailed 
Design Phase 


Operational 
Aspects (j prior 
to operations ) 


II HCIS 
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HCIS 

Approval 
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Approval 



etailed fire detection and 
protection layout 
including all types of 
extinguishing systems 
and hydraulic calculations 


Site operational systems 
including Incident 
Management System, 
permit to work system 
and all other safety 
related procedures 

































Safety Directives: 

Procedure 
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Preliminary 
Design Phase 
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When the project is being designed at the FEED stage a preliminary design 
for the site should be produced by the FEED engineers._. - Wm 


The FEED should take into account all 22 of the SAF standards. 

The preliminary design has to be submitted to an HOIS approved 
consultant for approval before the plant owner submits to HOIS for final 
approval. 

The HCIS consultant will produce a compliance matrix to show 
compliance/non compliance to the HCIS codes and consult with the FEED 
engineers to then ensure that the preliminary design is 100% in 
compliance. 

The preliminary design together with the compliance matrix is submitted 
by the plant owner to the HCIS for approval 
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Safety Directives: 


Detailed 
Design Phase 


Procedure 
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The EPC will receive a bid package from the owner, based on the FEED 
preliminary engineering. This includes the requirement that the EPC 
selects a fire engineering company that meets the requirements of HCIS 


SAF 1. 


The EPC should select a fire contractor(s) that meets the requirements of 
the HCIS and submit the companies pre-qualification document to the HCIS 
consultant for comment. If the consultant approves the document then the 
EPC should submit to the plant owner for transmission to and approval by 


the HCIS. 


The EPC should issue tender enquiries to the chosen approved 
contractor(s) 

The EPC should award the contract for the design, supply, installation and 
commissioning of the fire systems to the approved fire contractor 








Safety Directives: 

Procedure 


Operational 
Aspects (prior 
to operations) 
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The owner, in conjunction with the EPC will produce Site operational 
systems including Incident Management System, permit to work system 
and all other safety related procedures 


The Incident Management System (IMS) shall meet the requirements of 
SAF20 and be integrated with the Site Security Systems and the Site wide 
fire alarm and fire protection system. 


The IMS should be integrated from a hardware and software perspective to 
produce an easy to use system that can be used to: 
o Reduce loss of life 
o Reduce loss or damage to assets 
o Ensure any situation is controlled 
o Ensure the safety of personnel and Assets 
o Reduce hostile effects in the environment. 








Safety Directives: 

Procedure 
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Operational 
Aspects (prior 
to operations ) 




The IMS must provide Fast, Effective Access to Critical Incident Data 
Clear Command Communications 


Common Operational Picture: 
o Shared across an incident 
o Shared between many agencies 


Capacity to: 

o Operate on a massive scale 
o Operate over long timescales 
o Manage massive numbers of victims and resources 
o Minimise ecological and environmental damage 
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Safety Directives 

Procedure 
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Operational 
Aspects (prior 
to operations ) 


The Incident Management System shall meet the requirements of the 
NFPA. 


NFPA 450 Emergency Medical Services and Systems 


NFPA 472 Competence of Responders to Hazardous Materials7 Weapons 
of Mass Destruction Incidents 


NFPA 473 Competencies for EMS Personnel Responding to Hazardous 
Materials / Weapons of Mass Destruction Incidents 

NFPA 1006 Rescue Technician Professional Qualifications 

NFPA 1620 Pre-Incident Planning 

NFPA 1670 Operations and Training for Technical Rescue Incidents 


NFPA 1951 Protective Ensembles for Technical Rescue Incidents 






Ministry of the Interior, Kingdom of Saudi Arabia, 
High Commission for Industrial Security HCIS 


These New Directives must be applied on all new projects 
in the Kingdom of Saudi Arabia for Security and Safety. 

From July 2012 they will apply to all existing industrial 

facilities in Saudi Arabia. 

Any plant owner not meeting the standards will face 

serious consequences. 







Ministry of the Interior, Kingdom of Saudi Arabia, 
High Commission for Industrial Security HCIS 



Understanding the New Directives and their impact on the 
projects and existing security of industrial facilities in KSA 




















